Browser Same Origin Policy

Question

We have application hosted "xyz: 8080 /rootapp" and cometd services hosted on "xyz: 9090 /cometed". The JavaScript loaded from cometd server needs to access the DOM/JavaScripts loaded from (xyz:8080), the browser's same origin policy is not allowing it.

To overcome it we set 'document.domain' as "xyz" eliminating port. This solution is working well but this is becoming problem to all the iframes loaded by "xyz:8080" and I need to change each and every iframe to use domain as "xyz".

Can someone provide me hints to solve this problem without changing each and every iframe?

Do we have any http header to set domain?

Answer 1

You can use CORS to specify an exception to same origin, this will work in any relatively modern browser.

This page has a fairly good intro and a list of compatible browsers.

The short version is put an Access-Control-Allow-Origin header into the responses from xyz:8080 that contains either xyz:9090 or * (for unrestricted access).